drivers/net/telnet.c
drivers/wireless/bluetooth/bt_uart_bcm4343x.c
drivers/wireless/ieee802154/mrf24j40/mrf24j40.c
Kernel memory was allocated using kmm_malloc() or kmm_zalloc() but freed with with the user-space allocator free(). In the FLAT build, this is bad style, but not harmful because there is only a single, heap and malloc() and kmm_malloc() map to the same function.
But that is not true in the case of the PROTECTED or KERNEL builds. In those cases, there are separate heaps. kmm_malloc() will allocate from the kernel heap. free() will attempt to free the kernel memory from the user heap and will cause an assertion (or other obscure failure if assertions are disabled).
Gregory Nutt